Security

What type of security threats is Splunk most effective at responding to?

New Member

Hi guys,

Regarding Splunk's SIEM system, what type of threats is it most effective at responding to?

Thank you!

0 Karma

Esteemed Legend

That's the beauty; you get to decide! There is a very substantial pool of existing correlation searches that you can enable and if your desired search doesn't exist, you can create it. I guess the bast answer is "correlated attacks" and by that I mean that various things happen in multiple systems close to eachother in time. That is really the power of Splunk/ES.

0 Karma

Contributor

In essence, It can be taught via SPL and alerting to detect and respond to any threat you wish.
There isnt really any "most effective" as such, as it can do anything you want, and do it consistently well.

0 Karma